The vulnerability arises in the /admin/update-image1.php file of the PHPGurukul Online Shopping Portal Project. An attacker can manipulate the filename parameter to inject arbitrary SQL code. This flaw is a classic SQL injection (CWE-74 and CWE-89) that could allow an attacker to read or modify database records, potentially compromising confidentiality, integrity, or availability of the application’s data.

The affected product is PHPGurukul Online Shopping Portal Project version 2.1. The issue resides in the Parameter Handler component of the admin interface. No other versions are explicitly listed as vulnerable.

The CVSS score of 5.3 classifies this vulnerability as medium risk, and the lack of EPSS data means the exact likelihood of exploitation is uncertain. The description indicates that the attack can be performed remotely, likely by sending a crafted request to the filename argument of /admin/update-image1.php. While the exploit is publicly available, its effective use requires access to the admin endpoint, which could be privileged or protected by authentication. The overall risk is moderate, with potential for significant data compromise if the vulnerability is exploited.